Interpretation Conflict in Suricata - #VU162653
Published: November 9, 2026
Vulnerability identifier: #VU162653
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to bypass Suricata's DNP3 transaction-aware rules and logging for subsequent activity within a TCP flow.
The vulnerability exists due to improper handling of malformed link-layer frames by the DNP3 parser when parsing is enabled, which is not the default configuration. An unauthenticated remote attacker can send these frames to stop transaction inspection for the remainder of the flow if the app-layer error policy does not drop it.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7